CVE-2024-5690

What it actually does

The flaw permits remote attackers to infer the presence of specific external protocol handlers on a user's system through precise timing measurements of browser operations that interact with those handlers.

Why it matters to the business

Attackers can silently profile installed applications on end-user systems, enabling more targeted follow-on attacks or privacy violations that could expose organizational software inventories without user awareness.

How an attack unfolds

An attacker crafts a malicious webpage that initiates operations involving external protocol handlers and measures execution times; by comparing observed latencies against known baselines, the attacker deduces which handlers are functional, revealing details about the victim's installed software environment. No known threat actors are actively exploiting this at scale based on available data.

How to fix it

Upgrade Mozilla Firefox to version 127 or later, Firefox ESR to 115.12 or later, and Thunderbird to 115.12 or later. Apply vendor patches across all affected Mozilla products and rebuild any dependent Debian packages once upstream fixes are incorporated.

How to confirm the fix worked

Verify installed product versions against the fixed releases (Firefox >=127, ESR >=115.12, Thunderbird >=115.12) using about:support or equivalent system queries; confirm absence of the timing side-channel by testing with updated builds.

Typical attack path

1. User visits attacker-controlled webpage
2. Page executes JavaScript that triggers protocol handler resolution attempts
3. Attacker measures timing differences across multiple operations
4. Inferred protocol list is exfiltrated to attacker server
5. Attacker uses profile for targeted exploitation or reconnaissance

How to detect it

Review browser process logs and JavaScript execution traces for repeated protocol handler probes from external origins; correlate with network requests exfiltrating timing-derived data. No specific threat actor campaigns are currently associated with this issue.

What your security team should do

• Prioritize immediate deployment of patched Mozilla browser and email client versions enterprise-wide due to widespread use
• Monitor for any increase in EPSS or new exploit reports and accelerate patching if exploitation activity emerges
• Review web proxy or endpoint controls to limit untrusted JavaScript execution where feasible until updates are complete